[mikeland73]

Summary

Fixes P0 bugs #4 and #5 from specs/bug-scan.md.

• [nixtest] Add related work section to README #4 – token refresh panic (pkg/auth/auth.go): refresh did newToken.Extra("id_token").(string) without checking the type. Many OIDC providers leave id_token out of refresh responses, so every CLI using pkg/auth (including envsec) panicked once the access token expired. The assertion is now comma-ok, and when the refresh response has no id_token the existing one is kept, as OIDC intends. session.getRawIDToken had the same unchecked assertion and gets the same fix.
• Add workflow using Copybara to publish nixtest #5 – nil IDClaims() dereferences: IDClaims() returns nil for an empty or unparseable ID token.
  • pkg/auth: added nil checks in LoginFlowIfNeededForOrg and the whoami command.
  • envsec: added internal/claims.FromToken, which returns an actionable "please log in again" error instead of nil. It is used in envcli/flags.go, envsec/init.go, envsec/auth.go (whoami) and internal/flow/init.go.
  • The tokenstore call sites listed in the scan were already fixed on main in auth/tokenstore: don't panic on tokens without ID claims #603.

How was it tested?

• New pkg/auth/auth_test.go runs refresh against an httptest OIDC issuer:
  • When the refresh response has no id_token, the call succeeds and keeps the old ID token. On main, this test panics with interface conversion: interface {} is nil, not string.
  • When the response has an id_token, it replaces the old one.
• New envsec/internal/claims/claims_test.go covers a nil token, an empty ID token and an unparseable ID token.
• go vet and go test pass for pkg/auth/... and all of envsec.

Community Contribution License

All community contributions in this pull request are licensed to the project maintainers under the terms of the Apache 2 License.

By creating this pull request I represent that I have the right to license the contributions to the project maintainers under the Apache 2 License as stated in the Community Contribution License.

---

Generated by Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

The PR prevents auth panics when ID tokens are missing or cannot be parsed.

• Token refresh keeps the session's ID token when a provider leaves it out.
• Commands handle missing ID claims without crashing.

_{Reviews (2) · Last reviewed commit: "specs/bug-scan: mark P0 #4, #5 as fixed" · Reviewed by Greptile}